Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

Analysis

  • max time kernel
    599s
  • max time network
    597s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-04-2021 18:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    R_studio_7_8_serial_number_maker.exe

  • Size

    5.2MB

  • MD5

    c9d0760f5504d9e8ce237543fc4e7562

  • SHA1

    12dac9b23d9f95b9647767e15a265a73380ad50b

  • SHA256

    2519f6e84956fd35aaf7aa0ac51c2ce4cd8fddc973933936560ddb1efff6a16f

  • SHA512

    28e06d8763858601484ec3675b5d0895712b616d69b36d4c584f32dfb56dfe9a7c26ad05dfda27efc2e9512c11d7dedcafd4d69d98baffdda8eb5af9ba99398a

Score
10/10
azorultdcratxmrigdiscoveryevasioninfostealerminerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • XMRig Miner Payload 4 IoCs
    miner
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 28 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • NTFS ADS 1 IoCs
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
    1⤵
      PID:1080
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
        PID:2160
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2496
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2444
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
              PID:2432
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
              1⤵
                PID:2212
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1864
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1416
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1264
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Themes
                      1⤵
                        PID:1244
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:620
                        • c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                          1⤵
                            PID:360
                          • C:\Users\Admin\AppData\Local\Temp\R_studio_7_8_serial_number_maker.exe
                            "C:\Users\Admin\AppData\Local\Temp\R_studio_7_8_serial_number_maker.exe"
                            1⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4020
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3652
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                keygen-pr.exe -p83fsase3Ge
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3636
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                  "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3460
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                    C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                    5⤵
                                      PID:3920
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                  keygen-step-1.exe
                                  3⤵
                                  • Executes dropped EXE
                                  PID:2748
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                  keygen-step-3.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:1308
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                    4⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:1852
                                    • C:\Windows\SysWOW64\PING.EXE
                                      ping 1.1.1.1 -n 1 -w 3000
                                      5⤵
                                      • Runs ping.exe
                                      PID:2792
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                  keygen-step-4.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Checks computer location settings
                                  • Suspicious use of WriteProcessMemory
                                  PID:2312
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:2712
                                    • C:\Users\Admin\AppData\Local\Temp\UEHKAK3SD5\multitimer.exe
                                      "C:\Users\Admin\AppData\Local\Temp\UEHKAK3SD5\multitimer.exe" 0 3060197d33d91c80.94013368 0 101
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:3980
                                      • C:\Users\Admin\AppData\Local\Temp\UEHKAK3SD5\multitimer.exe
                                        "C:\Users\Admin\AppData\Local\Temp\UEHKAK3SD5\multitimer.exe" 1 101
                                        6⤵
                                        • Executes dropped EXE
                                        PID:4744
                                    • C:\Users\Admin\AppData\Local\Temp\P8GG9C75TN\setups.exe
                                      "C:\Users\Admin\AppData\Local\Temp\P8GG9C75TN\setups.exe" ll
                                      5⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:2308
                                      • C:\Users\Admin\AppData\Local\Temp\is-2N0V6.tmp\setups.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-2N0V6.tmp\setups.tmp" /SL5="$9002E,454998,229376,C:\Users\Admin\AppData\Local\Temp\P8GG9C75TN\setups.exe" ll
                                        6⤵
                                        • Executes dropped EXE
                                        • Checks computer location settings
                                        • Loads dropped DLL
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2700
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Modifies system certificate store
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of WriteProcessMemory
                                    PID:4044
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c taskkill /f /im chrome.exe
                                      5⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4592
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /f /im chrome.exe
                                        6⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4700
                                  • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe
                                    "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Full_Version.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:4892
                                    • C:\Windows\SysWOW64\WScript.exe
                                      "C:\Windows\System32\WScript.exe" "C:\Program Files\unins.vbs"
                                      5⤵
                                        PID:4984
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" "C:\Program Files\unins0000.dll",install
                                          6⤵
                                          • Loads dropped DLL
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:5100
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      PID:5004
                                      • C:\Users\Admin\AppData\Roaming\468F.tmp.exe
                                        "C:\Users\Admin\AppData\Roaming\468F.tmp.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Suspicious use of SetThreadContext
                                        PID:4708
                                        • C:\Windows\system32\msiexec.exe
                                          -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w4596 --cpu-max-threads-hint 50 -r 9999
                                          6⤵
                                          • Blocklisted process makes network request
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1816
                                        • C:\Windows\system32\msiexec.exe
                                          -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w6585@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                          6⤵
                                            PID:2220
                                        • C:\Users\Admin\AppData\Roaming\475B.tmp.exe
                                          "C:\Users\Admin\AppData\Roaming\475B.tmp.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          PID:4776
                                          • C:\Windows\SysWOW64\cmd.exe
                                            /c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Roaming\475B.tmp.exe
                                            6⤵
                                              PID:5856
                                              • C:\Windows\SysWOW64\timeout.exe
                                                timeout /t 3
                                                7⤵
                                                • Delays execution with timeout.exe
                                                PID:5892
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                            5⤵
                                              PID:2472
                                              • C:\Windows\SysWOW64\PING.EXE
                                                ping 127.0.0.1
                                                6⤵
                                                • Runs ping.exe
                                                PID:4908
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Checks whether UAC is enabled
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4544
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            PID:5056
                                            • C:\ProgramData\8093665.exe
                                              "C:\ProgramData\8093665.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3140
                                            • C:\ProgramData\540729.exe
                                              "C:\ProgramData\540729.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              PID:3008
                                              • C:\ProgramData\Windows Host\Windows Host.exe
                                                "C:\ProgramData\Windows Host\Windows Host.exe"
                                                6⤵
                                                • Executes dropped EXE
                                                PID:5356
                                            • C:\ProgramData\1168680.exe
                                              "C:\ProgramData\1168680.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:2908
                                              • C:\ProgramData\1168680.exe
                                                "{path}"
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6016
                                            • C:\ProgramData\6750068.exe
                                              "C:\ProgramData\6750068.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetThreadContext
                                              PID:5164
                                              • C:\ProgramData\6750068.exe
                                                "{path}"
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:6104
                                          • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                            4⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            PID:5568
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              PID:5628
                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                              5⤵
                                              • Executes dropped EXE
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5836
                                    • \??\c:\windows\system32\svchost.exe
                                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                      1⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:688
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                                        2⤵
                                        • Drops file in System32 directory
                                        • Checks processor information in registry
                                        • Modifies data under HKEY_USERS
                                        • Modifies registry class
                                        PID:4060
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                      1⤵
                                      • Drops file in Windows directory
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of SetWindowsHookEx
                                      PID:3120
                                    • C:\Windows\system32\browser_broker.exe
                                      C:\Windows\system32\browser_broker.exe -Embedding
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • NTFS ADS
                                      PID:1436
                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\InstaQuick.17.2102.1acwk.exe
                                        "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\InstaQuick.17.2102.1acwk.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4704
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:4148
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4212
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4612
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:752
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:500
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:5208
                                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                      1⤵
                                      • Modifies registry class
                                      PID:4628

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/360-123-0x000001E3D9ED0000-0x000001E3D9F37000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/360-277-0x000001E3DA540000-0x000001E3DA5A7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/620-270-0x000001D13FA00000-0x000001D13FA67000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/620-135-0x000001D13F320000-0x000001D13F387000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/688-84-0x0000021EE6C50000-0x0000021EE6C94000-memory.dmp

                                      Filesize

                                      272KB

                                      Download

                                    • memory/688-115-0x0000021EE6D10000-0x0000021EE6D77000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1080-299-0x0000026A87FE0000-0x0000026A88047000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1080-130-0x0000026A87F00000-0x0000026A87F67000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1244-107-0x000001FB5FF40000-0x000001FB5FFA7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1244-285-0x000001FB60010000-0x000001FB60077000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1264-111-0x000001A8F1E60000-0x000001A8F1EC7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1264-288-0x000001A8F1F40000-0x000001A8F1FA7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1416-275-0x000001537D940000-0x000001537D9A7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1416-137-0x000001537D860000-0x000001537D8C7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1816-140-0x0000000140000000-0x000000014070A000-memory.dmp

                                      Filesize

                                      7.0MB

                                      Download

                                    • memory/1816-142-0x000002021D040000-0x000002021D054000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/1816-300-0x000002021EA20000-0x000002021EA40000-memory.dmp

                                      Filesize

                                      128KB

                                      Download

                                    • memory/1816-145-0x0000000140000000-0x000000014070A000-memory.dmp

                                      Filesize

                                      7.0MB

                                      Download

                                    • memory/1816-146-0x0000000140000000-0x000000014070A000-memory.dmp

                                      Filesize

                                      7.0MB

                                      Download

                                    • memory/1816-148-0x000002021EA00000-0x000002021EA20000-memory.dmp

                                      Filesize

                                      128KB

                                      Download

                                    • memory/1864-281-0x000001D75FB10000-0x000001D75FB77000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/1864-138-0x000001D75F570000-0x000001D75F5D7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2160-127-0x000001B5E36B0000-0x000001B5E3717000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2160-297-0x000001B5E3720000-0x000001B5E3787000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2212-125-0x00000234A4E00000-0x00000234A4E67000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2212-292-0x00000234A4F40000-0x00000234A4FA7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2220-143-0x0000000140000000-0x0000000140383000-memory.dmp

                                      Filesize

                                      3.5MB

                                      Download

                                    • memory/2220-147-0x0000000140000000-0x0000000140383000-memory.dmp

                                      Filesize

                                      3.5MB

                                      Download

                                    • memory/2308-40-0x0000000000401000-0x000000000040C000-memory.dmp

                                      Filesize

                                      44KB

                                      Download

                                    • memory/2432-291-0x00000246A9530000-0x00000246A9597000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2432-114-0x00000246A8760000-0x00000246A87C7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2444-295-0x00000294E9C80000-0x00000294E9CE7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2444-117-0x00000294E9B60000-0x00000294E9BC7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2496-119-0x000002B7D2870000-0x000002B7D28D7000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2496-267-0x000002B7D2C20000-0x000002B7D2C87000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/2700-49-0x0000000002401000-0x0000000002405000-memory.dmp

                                      Filesize

                                      16KB

                                      Download

                                    • memory/2700-53-0x0000000003771000-0x000000000379C000-memory.dmp

                                      Filesize

                                      172KB

                                      Download

                                    • memory/2700-57-0x00000000001E0000-0x00000000001E1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2700-56-0x00000000037B1000-0x00000000037B8000-memory.dmp

                                      Filesize

                                      28KB

                                      Download

                                    • memory/2712-30-0x00000000011C0000-0x00000000011C2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/2712-27-0x0000000000B00000-0x0000000000B01000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2712-24-0x00007FFE07F10000-0x00007FFE088FC000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/2908-203-0x0000000008010000-0x0000000008011000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2908-185-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2908-233-0x0000000007F70000-0x0000000007F88000-memory.dmp

                                      Filesize

                                      96KB

                                      Download

                                    • memory/2908-232-0x0000000006D70000-0x0000000006DD3000-memory.dmp

                                      Filesize

                                      396KB

                                      Download

                                    • memory/2908-205-0x0000000004C40000-0x0000000004C45000-memory.dmp

                                      Filesize

                                      20KB

                                      Download

                                    • memory/2908-197-0x0000000004A40000-0x0000000004A41000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2908-198-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/2908-176-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/2908-180-0x00000000000E0000-0x00000000000E1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3008-192-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3008-183-0x0000000005350000-0x0000000005364000-memory.dmp

                                      Filesize

                                      80KB

                                      Download

                                    • memory/3008-189-0x000000000E030000-0x000000000E031000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3008-169-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/3008-178-0x0000000005340000-0x0000000005341000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3008-194-0x0000000005370000-0x0000000005371000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3008-173-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-164-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/3140-168-0x0000000000580000-0x0000000000581000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-221-0x0000000004F30000-0x0000000004F31000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-172-0x0000000000D20000-0x0000000000D21000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-179-0x0000000002880000-0x0000000002881000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-199-0x000000000A4B0000-0x000000000A4B1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/3140-193-0x000000000A460000-0x000000000A494000-memory.dmp

                                      Filesize

                                      208KB

                                      Download

                                    • memory/3460-29-0x0000000002590000-0x000000000272C000-memory.dmp

                                      Filesize

                                      1.6MB

                                      Download

                                    • memory/3980-39-0x0000000002330000-0x0000000002332000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/3980-35-0x00007FFE00700000-0x00007FFE010A0000-memory.dmp

                                      Filesize

                                      9.6MB

                                      Download

                                    • memory/4020-58-0x0000000002740000-0x0000000002741000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/4060-121-0x000001B681A00000-0x000001B681A67000-memory.dmp

                                      Filesize

                                      412KB

                                      Download

                                    • memory/4060-149-0x000001B684000000-0x000001B684106000-memory.dmp

                                      Filesize

                                      1.0MB

                                      Download

                                    • memory/4704-308-0x0000000072DE0000-0x0000000072E73000-memory.dmp

                                      Filesize

                                      588KB

                                      Download

                                    • memory/4704-309-0x0000000002A31000-0x0000000002A33000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/4744-63-0x00007FFE00700000-0x00007FFE010A0000-memory.dmp

                                      Filesize

                                      9.6MB

                                      Download

                                    • memory/4744-65-0x0000000000FC0000-0x0000000000FC2000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/4776-228-0x0000000000400000-0x000000000587C000-memory.dmp

                                      Filesize

                                      84.5MB

                                      Download

                                    • memory/4776-150-0x00000000075D0000-0x000000000CA4C000-memory.dmp

                                      Filesize

                                      84.5MB

                                      Download

                                    • memory/5004-104-0x0000000000400000-0x0000000000448000-memory.dmp

                                      Filesize

                                      288KB

                                      Download

                                    • memory/5004-75-0x0000000000800000-0x000000000080D000-memory.dmp

                                      Filesize

                                      52KB

                                      Download

                                    • memory/5056-158-0x0000000000890000-0x0000000000892000-memory.dmp

                                      Filesize

                                      8KB

                                      Download

                                    • memory/5056-154-0x00007FFE01C80000-0x00007FFE0266C000-memory.dmp

                                      Filesize

                                      9.9MB

                                      Download

                                    • memory/5056-155-0x0000000000090000-0x0000000000091000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5056-157-0x00000000007A0000-0x00000000007A1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5056-159-0x00000000007D0000-0x00000000007F1000-memory.dmp

                                      Filesize

                                      132KB

                                      Download

                                    • memory/5056-160-0x00000000007B0000-0x00000000007B1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5100-98-0x00000000043F0000-0x000000000442A000-memory.dmp

                                      Filesize

                                      232KB

                                      Download

                                    • memory/5100-103-0x0000000004480000-0x00000000044D6000-memory.dmp

                                      Filesize

                                      344KB

                                      Download

                                    • memory/5164-210-0x00000000018F0000-0x00000000018F1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5164-191-0x0000000000E70000-0x0000000000E71000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5164-243-0x0000000009E20000-0x0000000009EC4000-memory.dmp

                                      Filesize

                                      656KB

                                      Download

                                    • memory/5164-209-0x0000000005950000-0x0000000005951000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5164-187-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/5164-246-0x0000000005370000-0x00000000053CE000-memory.dmp

                                      Filesize

                                      376KB

                                      Download

                                    • memory/5356-219-0x0000000004F80000-0x0000000004F81000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/5356-208-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/6016-260-0x0000000007400000-0x0000000007401000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-239-0x0000000005DB0000-0x0000000005DB1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-236-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download

                                    • memory/6016-234-0x0000000000400000-0x000000000041C000-memory.dmp

                                      Filesize

                                      112KB

                                      Download

                                    • memory/6016-261-0x0000000007B00000-0x0000000007B01000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-240-0x0000000005850000-0x0000000005851000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-245-0x0000000005B60000-0x0000000005B61000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-244-0x00000000059C0000-0x00000000059C1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-242-0x00000000058F0000-0x00000000058F1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6016-241-0x00000000058B0000-0x00000000058B1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6104-247-0x0000000000400000-0x0000000000430000-memory.dmp

                                      Filesize

                                      192KB

                                      Download

                                    • memory/6104-263-0x00000000056E0000-0x00000000056E1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6104-253-0x0000000005720000-0x0000000005721000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6104-252-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                      Filesize

                                      4KB

                                      Download

                                    • memory/6104-249-0x0000000071A20000-0x000000007210E000-memory.dmp

                                      Filesize

                                      6.9MB

                                      Download